Secureworks BRONZE PRESIDENT December 2019

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

RCSession has used a file named English.rtf to appear benign on victim hosts.

Mustang Panda has executed PowerShell scripts via WMI.

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence. Mustang Panda has also created a scheduled task that creates a reverse shell.

RCSession can launch itself from a hollowed svchost.exe process.

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. Mustang Panda has also used VBA macros in maldocs to execute malicious DLLs. Mustang Panda also utilized a VBS Script “autorun.vbs” that created persistence through saving the VBS Script in the startup directory which would cause it to run each time the machine was turned on.

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.

Mustang Panda has communicated with its C2 via HTTP POST requests.

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.

Mustang Panda has used mshta.exe to launch collection scripts.

Mustang Panda has installed TeamViewer on targeted systems.

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. Mustang Panda has used WinRAR “Rar.exe” to archive stolen files before exfiltration. Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR `rar.exe` to archive files for exfiltration.

RCSession can use an encrypted beacon to check in with C2.

RCSession can be installed via DLL side-loading.

Mustang Panda has acquired C2 domains prior to operations.